Introduction

OCSP stapling can fail even when the certificate itself is perfectly valid. The server still needs the issuer chain, working DNS resolution, and outbound network access to the certificate authority's OCSP responder. If any of those pieces break, browsers and scanners report stapling problems although the certificate file itself looks correct.

Symptoms

  • SSL scanners warn that OCSP stapling is missing or not valid
  • The certificate chain validates, but stapling status is absent in test output
  • The issue started after a certificate renewal, firewall change, or resolver update
  • Only one server in a cluster shows the stapling warning

Common Causes

  • The web server does not have the correct issuer chain for stapling validation
  • The host cannot resolve or reach the OCSP responder
  • Resolver settings are missing in Nginx or Apache
  • Outbound firewall rules block the CA's responder endpoint

Step-by-Step Fix

  1. 1.Check whether the live server is stapling an OCSP response
  2. 2.Inspect the handshake before editing server config so you can compare before and after results.
bash
openssl s_client -connect example.com:443 -servername example.com -status
  1. 1.Verify the certificate chain and issuer files used by the server
  2. 2.OCSP stapling depends on a complete issuer chain, not only on the leaf certificate being valid.
bash
openssl verify -CAfile /etc/ssl/fullchain.pem /etc/ssl/certs/example.pem
  1. 1.Configure a resolver and enable stapling explicitly
  2. 2.Nginx needs DNS resolution to contact the responder and cache the response.
nginx
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 1.0.0.1 valid=300s;
resolver_timeout 5s;
  1. 1.Check outbound access from the server to the OCSP responder
  2. 2.If DNS or firewall rules block the responder, stapling never fills even with the right certificate files.
bash
curl -I http://r3.o.lencr.org

Prevention

  • Deploy the full issuer chain alongside every renewed certificate
  • Keep resolver settings explicit in TLS virtual host config
  • Allow outbound access to OCSP responders from public web servers
  • Validate live stapling after renewals, not just certificate expiry dates